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HOUSE OF COMMONS SCIENCE AND 
TECHNOLOGY COMMITTEE: “IDENTITY CARD 
TECHNOLOGIES: SCIENTIFIC ADVICE, RISK AND 
EVIDENCE” (SIXTH REPORT OF SESSION 2005-06) 


The Government’s response 


Terminology 


At the end of March 2006 the Identity Cards Bill received Royal Assent and 
became the Identity Cards Act 2006 (“the Act”). On the Ist April the Identity 
and Passport Service (IPS) was formed from the Home Office Identity Cards 
Programme and the United Kingdom Passport Service (UKPS). The projects and 
staff within the Identity Cards Programme were transferred to projects within 
IPS. As some of the events referred to in this document occurred before April 
2006, “IPS” and “the Identity Cards Programme” are used interchangeably to 
refer to the projects set up to deliver the identity cards scheme. 


Introduction 


The Government welcomes the report of the House of Commons Science and 
Technology Committee! (“the report”) which focused on the Home Office’s 
Identity Cards scheme as part of a wider inquiry into Government’s treatment of 
scientific advice, risk and evidence. 


The Committee announced a broad inquiry into the handling of scientific advice, 
risk and evidence in policy-making in November 20052, looking particularly at: 


i. Sources and handling of advice 

11. Relationship between scientific advice and policy development 
111. Treatment of risk 

iv. Transparency, communication and public engagement 


The report focused on the Identity Cards Programme’s treatment of scientific 
advice, risk and evidence on some aspects of which the committee made 
recommendations or asked for assurances. The report also endorsed the approach 
taken by the programme in a number of key areas. 


The nature and scope of the committee’s inquiry meant that it focused on certain 
areas of the Government’s plans for Identity Cards. The challenges of introducing 
identity cards include legislative and policy challenges, the integration of new 
and old business practices, creating the right communication and stakeholder 
engagement strategies, and creating the right financial and charging frameworks, 
as well as the challenges of setting the right requirements in the areas of 
technology, ensuring the best scientific advice is properly used and 
communicated and that a sensible approach to risk is taken. The report was 
chiefly concerned with the area of overlap between the committee’s inquiry and 
the work of the Identity Cards Programme and is not an assessment of the entire 
programme. 


The Government thanks the committee for their report and for the considerable 
work that went into the inquiry and the preparation of the report. It welcomes 
the committee’s scrutiny and analysis of the Identity Cards Programme and 


' “Identity Card Technologies: Scientific Advice, Risk and Evidence” 4 August 2006, HC1032, 
http://www.publications.parliament.uk/pa/cm200506/cmselect/cmsctech/1032/103202.htm 

2 Scientific advice to Government inquiry, 9 November 2005, 
http://www.parliament.uk/parliamentary_committees/science_and_technology_committee/scitech091105.cfm 


3 


would like to reassure the committee that their concerns will be considered very 
carefully and that it will endeavour to act on its recommendations. 


The Conclusions and Recommendations 


The report makes several general observations and recommendations 
(paragraphs 142-145 of the report). These will be discussed and then the 43 
specific conclusions and recommendations drawn from the body of the report 
will be addressed. 


The report’s conclusions begin by noting several areas where the committee 
recognise that the programme is following good practice in the treatment of 
scientific advice and evidence, including: 


i. The establishment of committees of experts 

ii. The use of OGC (Office of Government Commerce?) Gateway Reviews 
ii. Holding discussions with international experts 

iv. Committing to the trialling of technology 

v. Taking a cautious approach to the scheme and implementing it gradually 


The Government welcomes the Committee’s recognition of IPS’s good practice 
in these areas. 


The report said that the programme’s science agenda had “concentrated on 
biometrics” which appeared to have “detracted attention from other technological 
and scientific aspects of the programme” and that the assurance processes and 
governance of ICT (Information and Communications Technology) were less 
well developed than for biometrics and that the programme’s thinking on ICT 
was not being developed in consultation with other departments. 


A relatively higher level of effort in the development and assurance of the 
biometric requirements for Identity Cards than for other areas of technology is 
justified. Biometrics is an area of technology which is less mature than the bulk 
of the technology which the scheme is likely to use such as databases and 
communications networks. For this reason our risk management processes have 
identified more risks to do with biometrics than for some other areas of 
technology and the treatment and mitigation of these risks requires more effort. 
For similar reasons the House of Commons Home Affairs Committee singled 
out biometrics for scrutiny in their 2004 report on Identity Cards’. 


The report also argued that the biometric solution is being prescribed to the 
supplier market in some detail whereas for the bulk of the ICT needs the 
requirements being put to the market are more ‘output-based’. 


Both the ICT and the biometric technology will be constrained by legislation, 
government policy and the international standards and conventions adopted by 
the scheme. In the area of ICT, these standards and policy choices are defined 
in part in documents such as the e-GIF*. However, in the case of biometrics there 
are fewer agreed standards, so the procurement will have to be more prescriptive 
in order to be sure of getting proposals from suppliers which meet the 
requirements. 


The areas of biometric technology in which IPS is being prescriptive are chiefly 
around the data storage and exchange standards (as opposed to how the matching 
is done, for example). This is driven by the programme’s interoperability 


> http://www.ogce.gov.uk 

* House of Commons Home Affairs Committee: “Identity Cards” Fourth Report of Session 2003-04, 
HC 130-I, paragraph 175, http://www.publications.parliament.uk/pa/cm200304/cmselect/cmhaff/130/130.pdf 
> e-Government Interoperability Framework Version 6.1, http://www.govtalk.gov.uk/interoperability/egif.asp 


requirements and the need to adhere to international standards. For example, 
compliance with ICAO (International Civil Aviation Organisation) 
recommendations® for MRTDs (Machine-Readable Travel Documents) require 
the Identity Card to store certain biometric data in a certain format and thus 
make it necessary to set these requirements on the scheme’s suppliers. 


Recommendations were made that: 


i. The scheme should use a system architect and that an ICT assurance group 
should be established 


il. The programme should recognise the need for ongoing communication with 
stakeholders particularly in the areas of science and technology and that it 
increase clarity and transparency in those areas identified as being 
problematic. 


he 


ii. The programme should recognise the importance of trialling and if trials 
indicate that changes should be made to the programme that these changes 


are made even if they impact the delivery timetable. 


The committee made a number of statements relating to the establishment of an 
ICT assurance group. In particular (paragraph 55 of the report): “We welcome 
the balance of in-house and external advice regarding biometrics and recommend 
that a similar approach is used for ICT ... We recommend that the Identity and 
Passport Service establish an ICT Assurance Committee consisting of academics 
and industry experts and that this committee reviews the programme 
specifications relating to ICT”. 


The committee also made some recommendations on the governance and the 
relationship with academia of such a group and its role in overseeing trialling: 


“\.1f appropriate, that the Chief Information Officer chair the ICT 
Assurance Committee” (paragraph 57), 


“..we recommend that the Home Office uses the ICT Assurance 
Committee in order to fully engage the academic ICT community” 
(paragraph 61), 


“\..take advice from the ICT Assurance Committee on trialling” 
(paragraph 95). 


The committee also acknowledged the roles played by the Independent 
Assurance Panel and the Science and Technology Reference group in providing 
assurance on ICT but argued that a specialist ICT assurance group would be able 
to better serve the needs of the Identity Cards Programme. 


The Government is aware that this recommendation is central to the committee’s 
report and that the committee have given this a considerable amount of thought. 
The Government understands the powerful arguments made in the report for 
consolidating and strengthening the ICT assurance of the programme and accepts 
this recommendation. The Government believes that the Government CIO and 
the Home Office CIO should be at the core of IPS’s ICT assurance arrangements 
and that this would provide the best advice on ICT as well as getting best value 
from existing resources. Officials from IPS have begun setting out options for 
the formation of the group, including how it might consolidate existing advice 
on ICT such as that from the Independent Assurance Panel. It is difficult to put 
a firm timescale on the establishment of the group but the Government is fully 
aware that, in order to be useful, the group would have to be established early 
enough to influence technical policy and architectural decisions during 
procurement. 


6 In ICAO 9303-3 (ICAO publications can be purchased from http://www.icao.int/) 


On the need for ongoing communication with stakeholders, we will continue to 
work with our public and private sector stakeholder organisations. In the past 
this was done through bodies such as the programme’s Private Sector User Group 
and the Foresight Cyber Trust and Crime Prevention Programme’. Currently the 
main avenues for this are: 


¢ The Public Private Forum on Identity Management’; The Chancellor of the 
Exchequer recently appointed Sir James Crosby to chair this group which 
has been asked to review the current and emerging use of identity 
management in the private and public sectors, identify best practice, and 
to consider how public and private sectors can work together. The 
overarching themes of the group are the security of identity and cross- 
cutting issues of identity management across government. This forum will 
report to the Chancellor of the Exchequer and the Ministerial Committee 
on Identity Management. IPS has produced a digest of current Identity 
Management initiatives in the Public Sector for the chairman of this group, 
and developed a questionnaire for industry bodies in the Private Sector to 
help inform this group about the key issues in identity management and 
where the leading innovators and adopters are in the Private Sector. 


¢ The Identity Fraud Steering Group’, which acts as a vehicle to promote 
closer public and private sector collaboration to combat identity fraud, 
coordinates efforts and ensures that resources are targeted to resolving 
problems. This group has members from across government and relevant 
areas of the private sector, e.g. APACS (the UK payments association), and 
the British Bankers’ Association. 


In addition, IPS is engaging with other government departments to form 
partnerships to develop identity cards applications which meet their specific 
business needs. This work will inform the broader design of the identity services 
offered as the scheme is rolled out. 


With regard to the recommendation that changes to the programme suggested 
by the results of trials should be implemented “even if they impact the delivery 
timetable”, the Government’s priority is that the programme should have a 
sensible and practical delivery timetable rather than be focused on chasing 
unrealistic delivery dates. Trial results need to be used in a pragmatic way and 
should not distract from the need to deliver a workable solution in a timely and 
cost-effective manner. It would not be realistic to rigorously test everything 
before the scheme ‘goes live’ to the point where the Government can be sure 
that no further changes need to be made to the design of the scheme. Also, some 
parts of the solution will not be tested but will use ‘off-the-shelf’ technology 
that has been adequately tested elsewhere. 


The rollout of the scheme will be incremental and the technology used and the 
design of the scheme will evolve over time subject to strict change control. From 
the launch of the scheme the Government will be learning lessons and will use 
these to control the speed of the incremental rollout and inform the scheme’s 
ongoing technology refresh and process redesign. 


Finally, the overall conclusions of the report concluded that “If appropriate 
changes are made, the identity cards scheme could still become an example of 
good practice in the handling of scientific advice, risk and evidence”. 
The Government believes that this is already the case and fully agrees with the 


7 http://www. foresight.gov.uk/Previous_Projects/Cyber_Trust_and_Crime_Prevention/index.html. This was set 
up to use the best available science to explore the application and implications of the next generation 
technologies. Its work was commissioned by the Office of Science and Technology but its findings are 
independent of Government and do not constitute Government policy 

* The announcement of this forum: 
http://www.hm-treasury.gov.uk/newsroom_and_speeches/press/2006/press_51_06.cfm 

° http://www. identity-theft.org.uk/index.htm 


importance to the success of the programme of the continued use of good 
practice in the handling of scientific advice, risk and evidence. 


Stakeholder engagement 


Consultations 


1. The Home Office has consulted the wider community and has tried 
to apply best practice in this area. However, stakeholders are not satisfied 
with the nature of consultation and feel that consultations have been unduly 
limited in scope with unclear evidence gathering objectives. As a result, the 
wider community does not have the level of confidence in the scheme that 
could be expected following a successful consultation process. (Paragraph 
31) 


2. We recommend that the Home Office undertakes future 
consultations on scientific and technical issues as well as the procurement 
process. (Paragraph 33) 


In addition to the programme of social science research which is referred to in 
the response to paragraph 34 of the report’s conclusions, the Government has 
consulted widely on both the policy underlying the identity cards proposals and 
the legislation itself. The original consultation!® was published in July 2002, and 
the Government published a summary of its findings!! in November 2003. One 
of the findings, for example, was that the public reacted negatively to the term 
“entitlement cards”, which led to the change in terminology to “identity cards”. 
There was further consultation in April 2004!?. This included a draft Identity 
Cards Bill, which was the subject of Parliamentary scrutiny by the Home Affairs 
Select Committee in the course of its inquiry into identity cards. The Home 
Affairs Committee’s report and the findings of the consultation, which were 
published in October 2004!3, resulted in significant amendments to the draft Bill. 


The procurement strategy market soundings exercise was launched in October 
2005 to seek the views of the industry on procurement and implementation 
options for the National Identity Scheme. There were two clear objectives to this 
exercise: to provide all interested suppliers with the opportunity to comment on 
developing procurement strategies, and to gain a representative view of the 
market’s reaction to the developing procurement strategy and the technical 
viability of the programme. 


This exercise was widely advertised (via a Prior Information Notice published 
in the Official Supplement of the European Journal'*) and resulted in 67 
completed questionnaires being received. The programme held clarification 
meetings with a number of respondents to explore views expressed. All 
participants were provided with interim feedback!>, and the full results were 
published in August 2006'°. 


10 “Entitlement Cards and Identity Fraud”, CM 5557, 
http://www.identitycards.gov.uk/downloads/entitlement_cards.pdf 

'| “Entitlement Cards and Identity Fraud — the Government’s response to the consultation points”, CM 6019, 
http://www. identitycards.gov.uk/downloads/governments_resp_031111.pdf 

!2 “T egislation on Identity Cards: a consultation”, CM 6178, 
http://www.identitycards.gov.uk/downloads/2004-04-26-Legislation-on-Identity-Cards-a-consultation.pdf 

'3 “Identity Cards: A Summary of Findings from the Consultation on Legislation on Identity Cards”, CM 
6358, http://www.identitycards.gov.uk/downloads/id_summary_doc_3.pdf 

'4 OJEU reference: 2005/S 154-154064 

'S “Procurement Strategy Market Soundings (Interim Feedback)”, 
http://www.identitycards.gov.uk/downloads/Procurement_Strategy_Market_Soundings_Update-December- 
2005.pdf 

‘6 “Procurement Strategy Market Sounding (PSMS) Feedback”, 
http://www.identitycards.gov.uk/downloads/AugustPSMS_ProcurementStrategy feedbackfinal.pdf 


During any market sounding process, it is vital to ensure that a ‘level playing 
field’ amongst suppliers is fully preserved and that no supplier is given, or is 
perceived to have been given, an “inside track” or “unfair advantage” for any 
subsequent procurement. To achieve this aim for this activity, the exercise 
defined clear procedures for engagement with suppliers and other parts of the 
market. In essence, this can be summarized as follows: 


* No advice or guidance should be given that might lead to suppliers drawing 
conclusions about the shape of finalised requirements. 


¢ Information must not be revealed that is not publicly available. 


The need to maintain this ‘level playing field’ naturally placed some constraints 
on the scope and nature of the consultation. However the market was fully 
engaged in aspects that the programme considered at that point in time to be key 
areas and where market input was required, in particular: biometrics technology, 
smartcard technology, ‘matcher’ performance, data centre availability, smart card 
durability, procurement strategy, programme viability and secure product 
delivery. Consultation was not sought where requirements were already defined 
by existing legislation and standards, e.g. ICAO recommendations on MRTDs. 
The output from the market soundings has helped to shape the procurement 
strategy and inform the subsequent procurement process. 


IPS recognises the vital contribution that the market has to make to the success 
of procurement and is committed to ensuring appropriate engagement with 
stakeholders. In line with good practice for large and complex procurements, the 
market will have appropriate further opportunities to fully engage with the 
project team during any procurement activity. This may include industry days 
either before or after the publication of relevant notices in the Official Journal 
of the European Union (OJEU); an approach that has already successfully been 
used by the IPS contact centre procurement team to engage with interested 
bidders. 


Alongside the consultation on technical matters which has been done as part of 
the procurement process, the Identity Cards Programme has had ongoing 
consultation with technical experts from NPL since 2002 which has been used 
to test and inform the programme’s requirements. The procurement and 
legislative work built on contacts with Intellect made before the first consultation 
documents were issued. 


Ds We conclude that the processes by which scientific advice is 
incorporated into policy are not completely transparent and that 
organisations are not receiving feedback regarding their advice. We urge the 
Home Office to fulfil their welcome commitment to make it clear how and 
what advice has been incorporated into the development of future policy, 
particularly the technical specification. (Paragraph 36) 


The results of our detailed market engagement exercise, which focused on the 
procurement strategy for Identity Cards, were published on 3 August 2006. Also 
published was the Intellect ‘Concept Viability’ report that was commissioned as 
part of the exercise, giving anonymised industry views on the published 
information!’. 


The publication gives a clear overview of the advice and feedback that has been 
received and provides information on key areas that have been considered further 
and which have influenced the development of plans. Specifically this includes 
the adoption of a more incremental approach and alterations in the proposed 
packaging to help address technology integration risk across contracts. It also 
gives clarity where possible on many of the issues raised by industry, such as 


'7 Both available at http://www.identitycards.gov.uk/working-suppliers-procurement.asp 


the need for strong governance and the scope of procurement packages. IPS also 
made a clear commitment in this publication to update the market as its plans 
develop and has ensured that all those involved are aware of the publication. 


In some areas where IPS has asked for scientific advice this has been published, 
such as the first NPL feasibility study'*. The subsequent UKPS biometric 
enrolment trial which was done in response to the study’s recommendations 
demonstrates the Government’s use of external advice in shaping the programme. 
In some other areas, including some of the detailed scientific and technical 
advice the programme receives, the advice feeds directly into the scheme’s 
requirements. In these cases, full transparency on this advice is impossible until 
after the requirements have been published, and for this reason it may not be 
possible until then for the committee to properly judge the programme’s 
transparency. 


Clarity 


4. We are aware that political pressures inevitably impact on the 
scheme, but it is highly regrettable that the emphasis on different aspirations 
has changed. This has created uncertainty for the public and industry alike. 
We hope that the situation will stabilise now that the Bill has received Royal 
Assent. (Paragraph 37) } 


hee We urge the Home Office to finalise the scope of the scheme and the 
technical standards needed for interoperability as soon as possible. 
(Paragraph 42) 


The programme has been in existence for some time and the intention that the 
scheme provides a safe, convenient means of identification has not changed, nor 
have the statutory purposes. It is inevitable that discussions about a scheme that 
provides benefits in many areas is wide-ranging and will from time to time have 
a particular emphasis, especially where the scheme is being discussed in the 
context of a particular issue such as immigration control or combating the 
increased risk of identity fraud. But if one looks at the range of uses of the 
scheme set out in the consultation paper published over four years ago, it is 
consistent with what has been enshrined in legislation. 


The statutory purposes, which can only be changed with the agreement of 
Parliament, are: 


¢ the provision of a convenient method for ... individuals to prove registrable 
facts about themselves to others who reasonably require proof; and 


* the provision of a secure and reliable method for registrable facts about ... 
individuals to be ascertained or verified wherever that is necessary in the 
public interest. 


The definition of the public interest, which again can only be changed with the 
agreement of Parliament, is: 

* in the interests of national security; 

¢ for the purposes of the prevention or detection of crime; 

¢ for the purposes of the enforcement of immigration controls; 


¢ for the purposes of the enforcement of prohibitions on unauthorised 
working or employment; or 


¢ for the purpose of securing the efficient and effective provision of public 
services. 


'8 http://www. identitycards.gov.uk/downloads/feasibility_study031111_v2.pdf 


Regarding the technical standards needed for interoperability, the Government 
has already given a commitment that the Identity Card will comply with ICAO 
recommendations for MRTDs which implies a detailed set of technical 
specifications for the card and interoperability with equipment designed to read 
other travel documents. Further, while data and communications standards have 
not been specified, the Government can assure the committee that they will be 
constrained by the choices allowed by the e-GIF. 


6. In order to clarify when and how the card might be used, we 
recommend that the Home Office releases more information regarding what 
personal data will be revealed in different scenarios, including in an online 
context. Until this information is released, it is difficult to ascertain the true 
scope of the scheme and to fully understand how technology will be used 
within the scheme. (Paragraph 45) 


Until the card has entered widespread usage for identity verification it is 
impossible to say exactly what processes for checking identity will be used and 
what pieces of identity data might be used by different organisations. However, 
the use and storage of identity data is constrained by the Identity Cards Act (for 
example, section 12 of the Identity Cards Act!° lists those items of information 
which may be provided from the National Identity Register for the purposes of 
identity verification) and existing data protection legislation. Paragraph 40 of the 
report suggests that there exists some confusion between ministers on whether 
medical data will be stored either on the National Identity Register or on the 
card. There is no confusion; Ministers have stated that no medical data will be 
stored in the database — that is to say, the legislation does not mandate the storage 
of any medical data. However, the legislation does permit the cardholder to apply 
for any data to be stored voluntarily and so there is potential for an individual’s 
record to contain, for example, their organ donor status, should they wish and 
should this be permitted by the scheme. 


There appeared to be confusion among witnesses in the inquiry’s oral evidence 
session about the purposes for which data was held on the card and what data 
might be revealed when the card was used. A comment was made that in order 
to show that an individual was over 18 or over 65 it was not strictly necessary 
to have date of birth on the Identity Card and that this was an inappropriate 
disclosure of identity data*°. The date of birth is to be put on the Identity Card 
in order to comply with ICAO recommendations on MRTDs (as with passports); 
being able to use it to demonstrate age comes as a by-product of compliance 
with this. For age-related transactions the Government believes that a visual 
check of the card using the date of birth on the card is both sufficient and 
acceptable and is not aware of any widespread concerns around the use of 
documents like passports and driving licences (which show date of birth) as 
evidence of proof of age. 


IPS has developed a large set of usage scenarios and technical models of usage 
which include how the card might be securely used online. These have been 
discussed at length with other departments and representatives from the private 
sector (especially banking) but IPS cannot dictate how these organisations will 
use the card. 


Tf We recommend that the Home Office issues a clear timetable for the 
publication of the technical specifications and defines procurement 
processes and stages. (Paragraph 46) 


"9 http://www.opsi.gov.uk/ACTS/acts2006/6001 5--a.htm#12 
*” Oral evidence, 3 May 2006, HC 900 v, Q489 (Fishenden) 


When questioned on the timetable by the committee, Joan Ryan stressed the need 
for the timetable to remain flexible: “We have landmarks in this timetable to 
work with our partners to deliver on our building blocks. The committee is 
probably aware of things like biometric passports, UK biometric visas and 
biometric residence permits. Those kinds of developments and the feedback from 
them will help determine the timetable. The reason why the timetable is perhaps 
a bit looser than what might be called a very detailed timetable is because of 
that development and because we want to be very cautious on the basis of all 
the lessons we have learnt from good and bad projects.’””! 


Within this flexible timetable, the sequence of steps for each procurement will 
follow a standard sequence. The procurement process for the Scheme will be 
compliant with EU Procurement Regulations and will take full account of OGC 
best practice guidelines. The incremental approach means that there will be 
several separate procurements for different parts of the Scheme. Whilst the 
separate procurements may follow a different process according to their specific 
requirements they are likely to include a pre-OJEU strategy and scoping stage, 
a qualification stage, and then followed, depending on the procurement route, by 
an invitation to participate or negotiate stage, a call for final tenders and a 
contract closure and award stage. 


A high-level set of requirements will be published in the OJEU notice. Those 
companies who express an interest in the procurement and qualify to participate 
in the subsequent procurement phases will be issued with a full set of output 
based requirements for the relevant procurement. The procurement process will 
allow sufficient time to discuss these requirements with those industry 
participants who are best placed to deliver the required outputs as selected 
through the pre-qualification process. 


On the timing of procurement, the report suggests that procurement was due to 
start immediately after Royal Assent was granted”, which is not in fact the case 
and was rebutted in evidence given to the committee? — procurement was 
anticipated as commencing “a suitable time” after Royal Assent rather than 
immediately after. In any case, it would have been impossible to schedule 
procurement to start immediately after Royal Assent was granted as the timing 
of Royal Assent was not within the Government’s control, dependent as it was 
on reaching an acceptable compromise with opposition peers in the House of 
Lords. 


The approach for procuring the required services to deliver the Scheme will be 
an incremental one. This will be achieved by a phased introduction of new 
capabilities, while building on and growing existing capacity to support current 
and future requirements. This approach was supported by industry and has been 
communicated through the recent market soundings. 


It is our intention to release further information to the market on high-level 
requirements, timings and procurement stages as plans develop. Where 
appropriate we will also seek industry views on specific issues to ensure that we 
get these procurements right first time. 


Specifications for individual procurements will be released to bidders once 
procurements formally launch. Individual procurements will provide more 
detailed information on timings and process as part of the initial procurement 
documentation to interested suppliers. 


2! Oral evidence, 14 June 2006, HC 900 xi, Q1145 

22 Paragraph 46 of the report says “Initially the procurement process was due to start as soon as Royal Assent 
had been granted”. 

23 By Katherine Courtney: “a suitable time after Royal Assent we will begin procurement ... it cannot begin 
until after we have had Royal Assent on the Bill and also passed gateway reviews and a number of internal 
health checks”, Oral evidence, 22 March 2006, HC 900 iii, Q326-Q327 


1] 


Specifications will be, where possible, output based. This will give industry the 
greatest flexibility to propose the best technical solutions to meet the 
programme’s needs. In the case of procurements that are run under the EU 
negotiated or competitive dialogue procedures, there will be significant 
opportunity for selected suppliers to help develop and refine more detailed 
requirements with officials prior to final tenders being submitted. 


8. We are disappointed that two years after the Home Affairs 
Committee inquiry into identity cards the problems regarding clarity have 
not been resolved. We urge the Home Office to address these issues 
immediately. (Paragraph 47) 


The Home Affairs Committee raised** concerns over what they saw as a lack of 
clarity in the scope and the aims of the (then) draft Identity Cards Bill. The 
Government responded by setting out the scope of the scheme in section | of 
the Act. These purposes were covered in the response to paragraph 4 of the 
report’s conclusions. 


They also commented on a lack of clarity in explanations of the way in which 
cards would be used and in the level of check which would be expected in 
carrying out transactions. This issue is dealt with in the response to paragraph 
6 of the report’s conclusions. 


The Home Affairs Committee has published a report?> giving details of the 
progress made against their recommendations”®. 


Sources of scientific advice 


Advisory committees 


a We welcome the establishment of the Biometrics Experts Group and 
the Biometrics Assurance Group, although we regret the time that the Home 
Office has taken to set them up. We support the involvement of Sir David 
King and believe that the Assurance Group has the potential to work well, 
particularly in providing consistent advice across Government. We seek 
confirmation from the Home Office that the Biometrics Assurance Group 
will be given the direction, tools and time to fulfil its tasks in practice and 
that the Group’s recommendations will be taken into account. (Paragraph 
53) 


The Government thanks the committee for their recognition of the work of the 
Biometrics Experts Group and the Biometrics Assurance Group (BAG). The 
Government is fully committed to supporting the work of the BAG as it has done 
through its formative stage and will provide the resources necessary for the 
group’s functioning and to take into account the group’s recommendations. 


Regarding the amount of time taken to establish the BAG, this took longer than 
was anticipated. There are two principal reasons for this. First, there were 
difficulties in the selection of candidates. Biometrics is a relatively small area 
and so there was a very small pool to select from and candidates had to have 
the right credentials and also not be compromised (e.g. by having close links to 
a potential supplier). Secondly it became clear that the group would function 


*4 In House of Commons Home Affairs Committee: "Identity Cards" the Fourth Report of Session 2003-04, 
HC 130-1, http://www.publications.parliament.uk/pa/cm200304/cmselect/emhaff/130/130.pdf 

> First Special Report from the Home Affairs Committee: Memorandum from the Home Office: progress in 
implementing accepted Committee recommendations 2001-05, HC 1007, 2006, 
http://www.publications.parliament.uk/pa/em200506/cmselect/emhaff/1007/1007.pdf 

26 This report reproduces a memorandum from the Home Office listing actions taken by the Government in 
implementing accepted Home Affairs Committee recommendations since the start of the 2001 Parliament. 


better with the right governance structure within the Home Office and so there 
was some delay while the Senior Biometrics Adviser at the Home Office 
Scientific Development Branch was appointed. 


10. We recommend that the Identity and Passport Service establish an 
ICT Assurance Committee consisting of academics and industry experts and 
that this committee reviews the programme specifications relating to ICT. 
(Paragraph 55) 


The Government agrees with the committee that some considerable benefits 
could flow to the programme from having more focused specialist ICT assurance 
and accepts the committee’s recommendation to establish more formal 
arrangements to assure the programme’s ICT requirements and design work. 
Officials have begun investigating the implementation of this recommendation. 


The Independent Assurance Panel (IAP) has been able to advise us on some ICT 
issues particularly on issues of implementation and integration of new systems 
with revised business processes. However the Government acknowledges that 
some issues that could be covered by ICT assurance, such as analysis and 
recommendations on technical architecture, are outside the scope of the IAP. In 
accepting the committee’s recommendation, IPS will consider how to best use 
the ICT expertise that currently exists within the IAP. 


Engagement with industry needs to be done in such a way as to avoid 
compromising the procurement and for this reason the services of Intellect are 
used to mediate much of the discussion with industry. IPS has worked with 
Intellect to set up a number of seminars and 1-day conferences on specific issues 
relating to the identity cards scheme. 


11. We welcome the work that has been undertaken over the last two 
years by the Government in developing the network of Chief Information 
Officers and more recently, Chief Technology Officers. We have not received 
any evidence demonstrating that these changes have impacted upon the 
identity cards programme. Given the central role played by ICT in the 
identity cards programme, we recommend that the involvement of ICT 
professionals within Government in the scheme be made clear and, if 
appropriate, that the Chief Information Officer chair the ICT Assurance 
Committee. (Paragraph 57) 


The Government welcomes the committee’s support of the Chief Information 
Officers and Chief Technology Officers and assures the committee that members 
of the programme participate in the CIO and CTO Councils. These are bodies 
set up to share and coordinate thinking on technology and ICT across 
government. 


Shortly after IPS was formed from UKPS and the Identity Cards Programme, it 
appointed its own CIO, Annette Vernon, who until recently was responsible for 
Criminal Justice IT as CIO for the Department for Constitutional Affairs and has 
20 years’ experience in public sector IT based change. In her current role she 
has responsibility for: 


* the programme of business change and procurement activity to deliver the 
systems, processes and capabilities required for biometric e-passports and 
identity cards 


¢ the direction, integration, operation and delivery of IS/IT systems across 
the business 


¢ delivery of the key components of the identity cards scheme and 
implementation of the changes to the existing passports business which 
support these and the systems required to support this delivery process 
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In addition, the Home Office has a CIO and a CTO who also participate in the 
CIO and CTO councils. The Home Office CIO’s work feeds into that of the 
Identity Cards Programme by, for example, providing a strategic view of identity 
management systems across the Home Office Group. 


Academia and learned societies 


12. We believe that the Home Office is not taking full advantage of the 
impartial advice that could be offered by the academic computer science 
and information systems community. We recommend that the Home Office 
uses the ICT Assurance Committee in order to fully engage the academic 
ICT community. (Paragraph 61) 


Paragraph 59 of the report states “I do not think there has really been any 
consultation with the academic community’”?’. However, the Identity Cards 
Programme has used advice from academia — for example through its long 
association with technical experts from NPL, its involvement with the Home 
Office Science & Technology Reference Group and its individual discussions 
with the academics that make up that group. Members of the programme have 
spoken at Royal Holloway College on a number of occasions and also addressed 
a seminar of their Authentication and Identity Management Group. 


As already stated the Government accepts the committee’s recommendation to 
form a body to provide coherent advice on ICT and will consider how this body 
can engage the academic community. 


33 The LSE reports served a useful purpose in opening up debate on 
the scheme but the resulting emphasis upon the cost of the scheme and the 
errors in the initial interim report inhibited the development of the 
necessary wide-ranging debate. (Paragraph 65) 


14, We are disappointed by the nature of the Government’s reaction to 
the criticisms outlined in the LSE reports. We believe that the way in which 
the LSE reports have polarised the debate regarding identity cards, whether 
intentionally or not, has been detrimental. The Home Office would have 
been better advised to put together a dispassionate critique of the LSE 
Identity Project Report rather than seek to undermine its credibility and 
motivation. (Paragraph 67) 


The Government agrees with the Committee that the debate surrounding the LSE 
Identity Project Report has not assisted the development of a reasoned 
understanding of the issues surrounding the introduction of identity cards. 
Documents issued by the Home Office in response to that report were intended 
as a dispassionate critique but the Government acknowledges that this became 
overshadowed by a wider media debate. This reporting of the Government’s 
position and the issues raised by the LSE was not within the Government’s 
control. 


Nevertheless, shortly after the publication of the LSE Identity Project’s main 
report, officials from the Home Office Identity Cards Programme did make 
attempts to launch a more positive engagement with the LSE Identity Project 
Team. However, at an initial meeting, they were unable to provide a 
representative with sufficient technical expertise to discuss their report in 
adequate detail. Meeting formats later suggested to the Home Office by the LSE 
Identity Project Team risked breaching procurement rules for engagement with 
suppliers. Subsequently, no further concrete offers to engage in a more suitable 
environment were received. 


77 Quote from Professor Martyn Thomas, of the UK Computing Research Committee (UKCRC) 


Meanwhile, Home Office Ministers and officials have replied to letters from and 
attended debates with project team members. In particular, in an effort to launch 
a more considered debate, a letter? was sent on the 19th of December 2005 from 
Baroness Scotland to Professor Ian Angell of the Identity Project Team detailing 
specific concerns on the report’s analysis of biometric technology. No reply was 
received. However, IPS has engaged individual contributors or those individuals 
whose work was cited where their skills and background are relevant to the 
delivery of the Scheme. For example, one contributor is currently a member of 
the scheme’s Biometric Assurance Group. 


While recognising the overall media debate has not been helpful, the Government 
does not believe that it has been wrong to examine the assumptions behind the 
report itself. As the committee has noted elsewhere, it is important to assess the 
quality and objectivity of scientific or technological advice which relates to 
Government policy. In the case of the Identity Project Report, the Government 
is not alone in recognising a number of factors that cast doubt on the credibility 
of parts of the report as well as the impartiality of the report’s core team. Senior 
team members behind the Identity Project have maintained prominent positions 
in organisations that oppose ID cards in principle both before and during the 
development and publication of the Identity Project Report, yet this was not 
disclosed in the team’s publications or in mainstream media activity by the 
authors. Instead, such publications were presented as being objective and 
independent research. 


The Government supports the right of such individuals or groups to express their 
views in open debate. However, such views do not necessarily constitute 
objective, rigorous academic research. Therefore the Government maintains it 
was entitled to defend its proposals and to assert that the report was not as 
independent or accurate as was claimed by its authors. The Government certainly 
does not expect academics to agree with its proposals as a precondition for 
developing a good working relationship with them. However a productive 
relationship with academia must be based on a balance of trust and candour if 
that co-operation is to bear fruit. In this instance, the context of the Identity 
Project Report’s genesis, development and publication did not allow such a 
relationship to develop. 


Industry 


15. We recommend that, particularly as it enters the procurement phase, 
the Home Office works to develop further its relationships with industry. 
Industry is a significant source of scientific and risk reduction advice as well 
as being a pool of potential suppliers. We reiterate that the Home Office 
needs to engage in wideranging debate with industrial experts regarding 
scientific and technical aspects of the scheme. (Paragraph 70) 


The Home Office will continue to build relationships within the industry and 
utilise them as a valuable source of scientific advice. IPS will be engaging with 
independent experts and consulting across government during the procurement 
process to assist suppliers in developing the optimal solution to meet its 
requirements. In addition the relevant procurement process will be structured to 
allow a full dialogue with bidders to clarify the requirements (both in terms of 
the required outputs and any underlying technical constraints) and to understand 
how bidders are best able to meet these requirements. 


In addition the Identity Cards Programme undertook an extensive market- 
sounding process, meeting with relevant suppliers of systems and technology on 
an individual basis in 2004 and again in 2005, seeking their input and advice. 


28 Officials from IPS submitted this letter to the committee; however it is not in the published evidence. 
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Co-ordination within Government 


16. We recommend that the Home Office undertakes a cross- 
Government consultation regarding its plans for technology to support the 
identity card scheme before the specifications of the scheme are finalised 
and that it makes the findings of this consultation public. (Paragraph 76) 


IPS consults widely across government and this consultation has been going on 
since the beginning of the Identity Cards Programme and will continue, the 
results being incorporated into the scheme requirements. The Government 
acknowledges what the Committee has said about the need to be more public 
with its plans for identity cards: A review of the plans for the delivery of identity 
cards was commissioned by the Home Secretary over the summer and a strategic 
action plan, including plans for partnerships with other government departments, 
will be published in due course. 


Officials within the programme actively participate in cross-government groups 
on technology such as the Biometrics Working Group”? and the CIO and CTO 
Councils*®. There are also representatives from other departments on the boards 
which govern the programme. 


There is extensive engagement at the project level between the Identity Cards 
Programme and its delivery partners (those organisations which will deliver 
components of the identity cards scheme or related projects — principally the 
Home Office Immigration and Nationality Directorate, UKvisas, and the Foreign 
and Commonwealth Office’s Consular Services). In many cases, and especially 
in the area of biometrics, these projects share the same expert advisors. There 
is also participation in Home Office groups such as HOSIS (Home Office 
Strategic Identification Systems) and HOIME (Home Office Identity 
Management Experts). The Office of Government Commerce has praised the 
integration at senior level between the Identity Cards Programme and its delivery 
partners. 


International models 


17. We recommend that the Home Office continues to develop 
international links during the programme but stress that the limitations of 
advice and evidence from other schemes must be recognised by Ministers in 
the light of the unprecedented scale, the use of multiple biometrics and the 
complex IT requirements of the UK scheme. (Paragraph 80) 


18. In order to build public confidence in the technologies involved, we 
recommend that the Home Office publishes an overview of the scientific 
advice and evidence that it receives as a result of international co-operation. 
(Paragraph 81) 


IPS maintains strong international links with biometric standards setting 
organisations such as the International Civil Aviation Organisation (ICAO) and 
the International Standards Organisation (ISO) and with EU and non-EU states. 
IPS has been prominent in the development of new international standards for 
travel documents containing biometric features. 


IPS will continue to engage with the international community, monitoring 
developments in identity document technology and usage to ensure that benefits 
for the identity card scheme are identified and consideration given to their 
application within the scope and environment of a UK scheme. 


*») http://www.cesg.gov.uk/site/ast/index.cfm?menuSelected=4&displayPage=4 
80 http://www.cio.gov.uk/ 


The Government welcomes the committee’s recognition of its efforts thus far in 
engaging with standards organisations and schemes in other countries from 
which lessons can be learnt and assures the committee that it will continue to 
develop these international links. The Government agrees with the committee 
that there are limitations on what can be learnt from other schemes, arising from 
the differences in social conditions, technology, scale, etc. between the proposed 
identity cards scheme and other schemes and that these limitations must be taken 
into account when analysing or drawing conclusions from other schemes. 


Publishing detailed information from international schemes would undermine the 
Government’s ability to engage with these schemes. IPS already publishes some 
details about passports and identity cards issued by other countries*!, but could 
make it easier for the public to access through its website the publicly available 
data it is using from international bodies (ICAO, NIST”, etc.) and other identity 
card schemes. Such a move would demonstrate the broad nature of the 
programme’s consultation and investigations and inform debate, and IPS will 
endeavour to implement this as part of its communications strategy. 


The evidence base 


Trials 


19. We welcome the Home Office’s commitment to publicising fully its 
plans for trialling once the procurement process has begun. In order to 
continue this move towards transparency and to build public confidence in 
the scheme, we recommend that the Home Office also makes public the 
results of these trials. (Paragraph 83) 


The Government thanks the committee for their recognition of its commitment 
to openness in its plans for trialling. As was done for the UKPS trial, IPS will 
publish reports based on the results of future trials. 


20. We welcome the Home Office’s cautious incremental approach and 
we encourage the Home Office, if necessary, to extend the procurement 
phase to ensure that enough time is taken to gather the necessary scientific 
evidence and to undertake all the appropriate trials. In view of the potential 
adverse impact on large numbers of people, it is better that the scheme is 
late and workable than on time but flawed. (Paragraph 84) 


The Government thanks the committee for their recognition of the caution with 
which it is proceeding and assures the committee that it will continue with this 
policy. The committee’s recommendation suggests that the procurement phase 
should be extended to include all appropriate trials. The Government believes 
that better, more reliable results and better value for money can be achieved by 
rolling out the scheme incrementally and collecting data from these early stages 
with a view to using it to modify the scheme’s design as it grows. 


21. We recommend that the Home Office publicly outlines the ways in 
which the results of the trials have influenced and changed the programme. 
(Paragraph 85) 


It is not straightforward to make a link between a specific trial result and a 
specific requirement or set of requirements. To do so, and to publish 
relationships between trial results and our requirements would misrepresent the 
way in which requirements are iteratively formed from business needs, trial 
evidence, data from consultations and published works, and advice from industry 
experts. Such an approach would also fail to recognise the role trials play in the 


31 For example, http://www.identitycards.gov.uk/downloads/06-02-09-ID-Cards-in-other-countries1.pdf and 
http://www.identitycards.gov.uk/downloads/2005-08-10-ID-Cards-in-other-EU-countries2.pdf 
2 The US National Institute of Standards and Technology, http://www.nist.gov/ 


treatment of risk and specifically in supplying data to inform our confidence on 
the likelihood of risks occurring or not occurring. In these cases the impact on 
the programme would be, as a risk becomes more or less likely, the scale and 
associated costs of the mitigation plan for that risk. Trials also inform IPS’s cost 
modelling — an example of this is the enrolment timing data from the UKPS 
Biometric Enrolment Trial which informed the assumptions of the cost of 
enrolment. 


The trials that IPS expects to undertake are intended to test suppliers’ abilities 
to meet Home Office requirements. As these will be a factor taken into account 
during the overall evaluation of performance, these trials will directly affect the 
programme. The design of these trials takes account of the results of the UKPS 
biometric enrolment trial. For example, these trials may look at the performance 
of biometric systems when enrolling people who have biometrics which are 
challenging to record and will complement the UKPS trial (which tested process 
design and customer perception issues) with a test of the technology. The 
Government will follow a similar approach to the publication of these trial results 
as was used for the publication of the UKPS biometric enrolment trial results. 


Dee We seek assurance that the Home Office will not limit the number, 
scope or quality of technology trials in order to stay within the allocated 
budget. We recommend that the Home Office ensures that sufficient funding 
is available to undertake the necessary technology trials for this scheme and 
that it retains flexibility regarding the trials that may be required. 
(Paragraph 86) 


Flexibility regarding the scope of the trials within certain constraints is good 
practice and the Government accepts this recommendation and assures the 
committee that the trialling strategy will be able to adapt to changing 
circumstances and the results of trials. However, as with all Government 
activities, trialling has to be managed within the usual budgetary disciplines and 
so while the Government can assure the committee that trials will be well-funded 
it will also fulfil its obligation to achieve value for money. 


23. There is evidence that whilst trial plans were set out clearly the 
processes with which they were enacted lacked rigor. As a result, the Home 
Office has selectively used evidence from the biometrics enrolment trial to 
support its assertions. We believe that the Home Office has been inconsistent 
regarding the status of this trial and this has caused confusion in relation 
to the significance of the evidence gathered about biometric technologies. 
We recommend that the Home Office clarifies whether or not it accepts the 
validity of the results gained during the trial regarding the performance of 
biometric technologies. (Paragraph 88) 


The Government does not accept the validity of the results relating to the 
performance of the biometric technology because the technology was not 
optimised or set up for the requirements of a national identity card system. The 
report of the UKPS Biometric enrolment trial clearly stated*? that the aim was 
to test the processes and record the customer experience and was not a 
technology trial. This was underlined by Dr Mansfield of NPL in the committee’s 
inquiry: “The trial was not devised as a performance trial but it illustrated that 
if you just buy off-the-shelf systems and deploy them with no adaptation to the 
ID cards programme the performance would not be terribly good”4. The results 
showed that the technology as implemented in the trial fulfilled the needs of the 
trial but was not appropriate for enrolment of biometrics of a level of quality 


3 Section 1.1.2 of the report. The management summary of the report which includes this section is 
available at http://www.passport.gov.uk/downloads/UKPSBiometrics_Enrolment_Trial_Report- 
Management_Summary.pdf 

4 Oral evidence, 3 May 2006, HC 900 v, Q573 


needed for large-scale deployment. However the results can be used, and have 
been used, to show the base level of the performance of the technology — i.e. the 
level of performance which can be achieved with off-the-shelf equipment 
without any specific evaluation or configuration. This use of the results may have 
contributed to a misunderstanding in some quarters of the purpose of the trial. 


24. Given the findings of the biometrics enrolment report regarding the 
performance of current biometric systems, we seek reassurance from the 
Home Office that systems will be adapted as necessary to improve 
performance levels and that final performance levels will be verified by 
independent testing. (Paragraph 89) 


Given that it was not set up to achieve optimum technical performance, the 
Government expects the technical performance of the biometric solution 
proposed by suppliers to be better than that used in the UKPS Biometric 
Enrolment Trial. 


Also, as was stressed in oral evidence given to the committee*>, the Government 
will learn from the experience and continuous improvements in performance of 
other successful large-scale biometric systems such as IDENT1 (the successor 
to the Police’s automated fingerprint system), and smaller-scale systems such as 
IRIS*¢ and IAFS?’. 


IPS will test its contractors’ technology to ensure that it meets its requirements. 
Should the tests indicate that any system falls short IPS will require its contractor 
to adapt its technology as necessary. Testing will be independently assured 
whenever this is appropriate, for example at completion of significant system 
components. 


pany, We note the lack of independent evidence relating to the performance 
of iris scanning and welcome the Home Office’s commitment to undertake 
a large-scale matching test using pre-recorded biometrics. Given the relative 
lack of information available publicly regarding the performance of 
biometrics in a national scheme, we recommend that once the scheme is 
established the Home Office publishes details of the performance levels of 
the technology. (Paragraph 91) 


The Government thanks the committee for their recognition of its commitment 
to large-scale testing. As stated in the response to paragraph 19 of the report’s 
conclusion, IPS policy is to publish reports based on the results of future testing 
and trialling work. IPS will publish details of the testing of the scheme in 
operation, but cannot commit to publishing all details of the performance of the 
biometrics, especially where these might compromise the integrity of the scheme 
— e.g. if the results indicate how to subvert the security of the scheme. 


The Government has carefully considered the comments made by the committee 
on the collection of data (paragraph 91 of the report “...the Home Office’s 
unscientific approach”). We consider however that a thorough review of existing 
test data*® in order to inform our requirements and plans for further testing is 
entirely appropriate and a good example of the application of scientific method. 


26. We are surprised and concerned that the Home Office has already 
chosen the biometrics that it intends to use before finishing the process of 
gathering evidence. Given that the Identity Cards Act does not specify the 
biometrics.to be used, we encourage the Home Office to be flexible about 
biometrics and to act on evidence rather than preference. We seek assurance 


35 Oral evidence, 14 June 2006, HC 900 xi, Q1167 

36 Iris Recognition Immigration System, http://www. iris.gov.uk/ 

37 Immigration and Asylum Fingerprint System 

38 This data was supplied to the Committee in response to a request 
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that if there is no evidence that any particular biometric technology will 
enhance the overall performance of the system it will not be used. 
(Paragraph 93) 


The Government can give the committee this assurance and notes that “overall 
performance” includes accessibility, usability and reducing failures to enrol??. 


Much of our choice of biometrics is driven by: international obligations 
(principally ICAO 9303) to use fingerprints and face. We have some flexibility 
in how many fingerprints to use and whether to use iris. However, some firm 
decisions have been made — for example, the Act is clear on the point that there 
is no power to require a person to provide DNA. 


Decisions we make on this will be influenced by how well our trial results match 
previous data and also how consistent the performance of the biometrics during 
roll-out is with the trial data. 


PAB We note the lack of explicit commitment from the Home Office to 
trialling the ICT solution and strongly recommend that it take advice from 
the ICT Assurance Committee on trialling. We seek an assurance that time 
pressure and political demands will not make the Home Office forgo a trial 
period or change the purpose of the scheme. (Paragraph 95) 


As noted earlier, the Government accepts the committee’s recommendation that 
it establish a body to provide ICT assurance. The precise nature of this is yet to 
be decided but advice on and review of the policy and practice of ICT testing 
is likely to be within its remit. 


It is not possible at the moment to give a firm commitment as to the nature or 
timing of the trialling which may be undertaken. However, the Government can 
assure the Committee that, as we have said before, the statutory purposes of the 
scheme can only be amended with the consent of Parliament. 


The purpose of the scheme remains as outlined in the Act. A major plank in 
approaching risk within the programme, and indeed within all operational areas 
of IPS with regard to change, has been to mitigate risks by adopting an 
incremental approach to implementation. IPS has always maintained that it is 
planning to deliver the scheme incrementally by rolling capability out in discrete 
packages over time. IPS is fully committed to this incremental approach 
particularly where it contributes to the mitigation of risk and the delivery of early 
benefits. 


Testing has always been, and will continue to be, a key part of the development 
of any technical solution. Testing will be undertaken through the life of the 
scheme. During the life of the scheme IPS will trial the technical solution at key 
points in its development, and will be looking for assurance that the technical 
solution is fit for purpose before it is deployed in the live environment (and 
before relevant payments are made to the suppliers). The specific details of the 
testing approach will be notified to the bidders who qualify for the procurement 
at the appropriate point in the procurement process. 


The Government has always accepted the need to trial components of the 
scheme, and has allowed provision in the legislation but as to the nature and 
extent of trialling, decisions on this will be based on indications from IPS’s risk 
management strategy as to what trialling is necessary and on feedback from 
suppliers. 


* E.g. Use of multiple biometrics can reduce the overall failure to enrol: Oral evidence, 22 March 2006, 
HC 900 iii, Q295 


The committee’s chairman attended a confidential briefing on the Identity Cards 
Programme risk register and the committee’s report expressed that they felt 
reassured by the programme’s approach to risk management. IPS will continue 
with this approach to risk management to identify those parts of the technology 
where trialling of the suppliers’ intended solutions would have the greatest 
positive impact on the programme’s overall level of risk. Trialling of the end-to- 
end solution before going live would imply the trialling of a large number of 
low-risk technologies (e.g. email) and would not be cost-effective and may 
needlessly delay launch. The performance of the end-to-end solution will be 
tested during the rollout, the risk of this strategy being controlled, if necessary, 
through varying the rate of the rollout. 


Likewise, as the design of the technical solution adopted for Identity Cards is 
worked out between IPS and the chosen suppliers, only then will the Government 
be able to be absolutely sure of the different levels of testing different parts of 
the scheme require. It is worth noting that in cases where IPS has introduced 
new technology in the past acceptance testing and other testing has been 
undertaken, and there has been a gradual roll-out. For example the new e- 
passport, which contains a contactless chip, underwent extensive durability and 
other testing and was trialled through cooperative arrangements with other 
countries. It was issued initially to a small group of diplomatic passport holders 
and then over a six month period we progressively increased the proportion of 
passport applicants who received an e-passport rather than the earlier version 
until all passports issued were of the new format. Approximately two million of 
these have now been issued without significant problems, underlining the 
effectiveness of this trialling strategy. 


Research and development 


28. We recommend that the Home Office identifies the gaps in the 
evidence base underpinning the identity cards programme, that it 
commissions research to fill these gaps and that it feeds any new 
developments into the scheme where appropriate. This process should be 
overseen by the departmental Chief Scientific Adviser. (Paragraph 96) 


IPS is continuously analysing the evidence base for identity cards and assessing 
where more work is needed as part of the risk management process. Where a 
risk indicates there is insufficient evidence then additional work is commissioned 
— for example IPS is commissioning work on data modelling and managing large 
volumes of data. 


All science in the Home Office is overseen by its Chief Scientific Adviser 
including that underpinning the identity card programme. The overview of social 
science is maintained through all projects passing through the Project Quality 
Approval Board prior to starting. This ensures that all projects are both policy- 
focused and of.appropriate scientific quality. Physical science research in 
biometrics is overseen by two groups, the Home Office Strategic Information 
Systems Technical Operations group (HOSISTO) and the Biometrics Assurance 
Group. The head of the Home Office Biometrics Centre of Expertise, who 
reports to the Chief Scientific Adviser, chairs the HOSISTO group and sits on 
the BAG (Biometrics Assurance Group). The BAG has as part of its remit the 
identification of gaps in research and brings to its overview of the programme 
a wide spectrum of expertise, including experts from industry and academia. The 
BAG is chaired by the Government Chief Scientific Adviser, Sir David King. 


29. The Home Office cannot afford to delegate responsibility for horizon 
scanning to others. We recommend that the Home Office actively undertakes 
horizon scanning activities relevant to the technologies involved in the 
identity cards programme and that it develops mechanisms to feed this 
information back into the scheme. (Paragraph 97) 


21 


22 


Central to risk management is the analysis and discovery of areas of technology, 
policy, etc. in which the future is uncertain. Many of the risks in the Identity 
Cards Programme’s risk register have been uncovered by the sort of horizon 
scanning referred to by the Committee. Whilst government will expect the 
consortium that wins the project to maintain a horizon scanning function to 
ensure that advantage is taken of any emerging knowledge and technologies, the 
Home Office will continue its horizon scanning to ensure that when new 
opportunities arise they are used to best address the challenges it faces. The 
Home Office horizon scanning work comprises of two major strands, the scan 
of emerging technologies and the social horizon scan — both these elements 
maintain strong links with the Office of Science and Innovation Horizon 
Scanning Centre. The scanning of emerging technologies is undertaken by the 
Home Office Scientific Development Branch — a team of scientists and engineers 
that apply technology to fight against crime that includes the Biometric Centre 
of Expertise. This liaises with industry and academia to take advantage of the 
most up to date, robust and secure solutions in the biometrics field. The Home 
Office also has a dedicated team that undertakes social horizon scanning that 
includes analysis of future changes and challenges in society, which also reports 
to the Chief Scientific Adviser. Further, the development of the Identity Card 
scheme itself shows that the Government is looking at longer term strategic 
solutions, to ensure that increased global mobility does not put at risk our 
security and prosperity. 


30. We urge the Home Office to commission, and where appropriate 
fund, research focused on the specific requirements of the information 
technology systems in the identity cards scheme rather than relying on 
general existing study results. (Paragraph 98) 


A framework contract has been put in place with QinetiQ to allow the 
programme to call on their technical expertise and research capacity in support 
of the Identity Cards Programme. At present they are engaged in a data 
modelling exercise to identify the anticipated volume of data and its routing 
based on a model solution. The aim of this is to identify problems associated 
with high data volumes and to suggest where ‘choke’ points might be. This 
analysis will be used to inform the business practices used to reduce the volume 
of data being moved around the system and to evaluate suppliers’ proposals. 


Technology and operating costs 


31. We recommend that the identity cards programme team returns to 
the KPMG audit report and implements its recommendations. 
Furthermore, we re-emphasise that the Home Office needs to work out how 
costs will impact on performance and we seek reassurance from 
Government that cost limitations will not compromise the level of 
performance that is accepted. (Paragraph 102) 


With regard to the point on cost limitations compromising the level of 
performance that is accepted, IPS is committed to managing procurement and 
development to enable it to achieve the required performance standards while 
maintaining value for money. 


KPMG produced an audit report of the cost methodology and cost assumptions 
used for the identity cards Outline Business Case (OBC) in November 2005*°. 
The report made twelve specific recommendations and also commented on both 
the high quality of the OBC and the highly skilled team responsible for its 
production. 


4° “Cost Methodology and Cost Review, Outline Business Case Review”, 7 November 2005, 
http://www.identitycards.gov.uk/downloads/2005-11-7_KPMG_Review_of_ID_Cards_Methodology.pdf ~ 


IPS has carefully considered all of the recommendations of the KPMG report 
and directly implemented eight of them. The actions taken in relation to the 
remaining four recommendations are summarised below: 


Recommendations 3 & 4 — Consider the use of a more detailed risk-based 
approach, such as Quantitative Risk Analysis (QRA), for Scheme total 
cost estimation and a formal process to link the programme risk register 
and risk assessments to the estimation of optimism bias and contingency. 


A specific role has been created for a risk analyst to co-ordinate the collection 
and assessment of risk information from the managers responsible for 
maintaining risk registers and undertaking qualitative risk assessments for 
projects (including procurements) within the programme. The role includes 
working with the programme’s financial analysis and modelling team to carry 
out quantitative risk analysis, where feasible, using this information. The analysis 
will be used to prepare, and periodically update, estimates of the overall financial 
and economic risk associated with the Identity Cards Programme. The 
programme’s full business case, when developed, will present these estimates. 


Quantitative risk analysis will also be carried out within the procurement projects 
being undertaken by IPS in order to estimate the amounts of risk transferred to 
suppliers during contract negotiations. 


Recommendation 8 — Consider increasing the five-year depreciation 
assumption for mobile enrolment centres to eight years. 


Following a review of this proposal it was considered prudent to continue with 
a five year depreciation period for these assets. The cost impact of this 
assumption remains marginal. 


Recommendation 11 — Review the staffing levels for the internal ICT help 
desk and data centre operations of the National Identity Register (NIR) 


This recommendation remains under review as the requirements for the NIR are 
still being developed. 


32. We are sceptical about the validity of costs produced at this early 
stage. We acknowledge that the release of firm overall costing has been 
driven by political imperatives but the Home Office could have credibly 
given a broad range instead of precise figures. We note the danger that a 
desire to keep below a costs ceiling might drive the choice of technology. We 
seek assurances that the costings are flexible. We strongly recommend that, 
once the procurement process has taken place, the Home Office publishes 
a breakdown of technology costs, including set-up costs, running costs and 
predicted savings as a result of the scheme in the Home Office and 
elsewhere. (Paragraph 105) 


The cost estimates published are based on a reference design and as such are 
improved and revised as our understanding of the underlying cost assumptions 
‘improves. These will continue to be refined through discussion with the market 
and comparisons with appropriate benchmark projects throughout the 
procurement and, therefore, remain flexible. IPS is committed to securing a 
value-for-money solution and this will be an important factor in the choice of 
technology. 


With regard to the committee’s recommendation to publish a breakdown of 
technology costs after the procurement has taken place, the Act requires the 
Home Secretary to publish a report that sets out the expenditure on the scheme 
every six months from the date the Act was passed*!. Whilst we are keen to 


4! The first such report was published on 9th October and is available at 
http://www.identitycards.gov.uk/downloads/costreport37.pdf 
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remain open and transparent on the level of detail provided to the public in the 
cost estimates for the programme, we must also protect the commercially 
sensitive information of our suppliers. The price that they are charging for the 
technology services will be commercially sensitive. IPS will publish whatever 
information it can but will need to ensure that it does not compromise the 
competitive position of any of its suppliers in doing so. 


IPS is also open with regard to its corporate and operational costs and as an 
executive agency has an obligation to publish annual accounts*. 


33. We recommend that the Home Office prioritise funding as necessary 
to ensure that required social science research is undertaken and if 
necessary commissioned. In particular, we emphasise the need to undertake 
work to understand the attitudes of prime users towards the current 
proposals. (Paragraph 109) 


IPS, as part of the Home Office, sets aside funds in annual budgets to facilitate 
the running of social science research projects. Since the merger of UKPS and 
the Identity Cards Programme in April 2006, these have fallen into two 
categories: Social science research to support the ongoing issue of passports; and 
social science research to support new product and service design (such as the 
biometric passport) and development focused on the identity cards scheme. IPS 
has a full programme plan to meet these objectives including social science 
research to understand the attitudes of prime users (business and citizen 
customers) towards the current proposals. 


The Government notes the comment in paragraph 106 of the report: “In oral 
evidence to us, Professor Angela Sasse said that she thought that the Home 
Office became aware of the societal impact of the scheme during the Home 
Affairs Select Committee investigation in 2004”. This is not the case; in fact the 
Home Office was aware of the societal impact of the scheme from its inception 
in the autumn of 2003 and commissioned research as part of the Home Office 
Crime Survey for fieldwork in early 2004. Face-to-face ‘in home’ interviews 
among a representative sample of the public in England and Wales were held on 
4-8 February 2004 and 31 March-4 April 2004, well before the publication of 
the Home Affairs Select Committee findings. The Identity Cards Programme 
also commissioned (and published) research on the public’s views during the first 
consultation exercise during 2002-03%. 


In reference to Professor Anderson’s statement in paragraph 108: “The 
challenges of implementing the various biometric technologies have been the 
focus of concern, and it appears that less attention has been given to the 
challenges of how to design and implement the system in ways that are usable, 
useful and appropriate”: IPS has consulted with a number of potential private 
and public sector business customers of the identity cards scheme and proposes 
to carry out further research and consultation within the current programme. 
Potential public and private sector users of the scheme’s views are being carefully 
considered in the design of identity service delivery. IPS has also consulted with 
several disability and special interest organisations to gather information for the 
usability and accessibility requirements of the scheme and specifically recruited 
disabled groups (as well as a representative sample of the UK population) in the 
UKPS Biometric Enrolment Trial. 


34. We recommend that the Home Office establishes a clear process by 
which advice from external social science experts regarding future research 
and the social science aspects of the programme can feed into the scheme. 


*? For example, the 2005-06 annual report and accounts are available on the agency’s website: 
http://www. passport.gov.uk/downloads/HC1544_UKPS.pdf 

*’ Various publications on this consultation exercise: http://www.identitycards.gov.uk/news-publications- 
legislative.asp 


Once research has been undertaken, we urge the Home Office to develop 
the expertise that will allow it to follow up the results. (Paragraph 111) 


A clear process by which advice from external social science experts can be fed 
into the scheme is already in place. As was stated in response to written 
questions*4, advice is received from Home Office Research Development and 
Statistics (RDS), Central Office of Information (COI), plus external research 
bodies commissioned to conduct research such as Taylor Nelson Sofres and 
Cragg Ross Dawson. These organisations themselves provide a wealth of social 
science knowledge and practical experience in conducting social science research 
to the programme. Where the programme has considered more technological 
elements of the programme external academic opinion has been sought, for 
example, through the Foresight Cyber Trust and Crime Prevention Project and 
the Science and Technology Reference Group, both of which have external 
academic membership. 


When necessary, specific pieces of work are commissioned following the usual 
competitive tender process and the results form part of the evidence needed for 
informed decision-making. For example, in 2005 as part of the move to require 
first-time passport applicants to apply ‘in person’, UKPS commissioned work 
on the travel time to passport offices which would be required of various 
population groups living in various areas of the country for different numbers 
and configurations of passport offices. This was done alongside consultation 
with local agencies and authorities representing remote areas of the UK, and the 
results and recommendations were then considered by the project board in the 
context of other project requirements and a decision on the number and 
distribution of offices was taken. 


IPS Marketing and Communications department has personnel highly 
experienced in analysing the results of customer opinion based social science 
research. Following analysis, all results are used to inform appropriate parts of 
the programme and, where appropriate, processes and approaches are refined. 


The treatment of risk 


Treatment of risk 


35. The Home Office has provided us with details of the risk 
management strategy within the identity cards programme. However we are 
disappointed that the Chairman was not allowed to view the risk register in 
confidence. In the light of the evidence provided to us, we are somewhat 
reassured by the Home Office’s risk management strategy. Any delay to the 
procurement process will postpone the treatment of various risks. We seek 
assurance that the timing of the procurement process will be considered in 
relation to risk management. (Paragraph 116) 


The Government thanks the Committee for their endorsement of IPS’s risk 
management strategy. On the point about allowing the committee access to the 
risk register, this is an internal document which is confidential in nature. 
Furthermore, the majority of the risks in the register relate to business change, 
finance and commercial issues rather than the technical risks the Committee 
were interested in, and as such fall outside the scope of the Committee’s inquiry. 


The procurement programme for identity cards will involve a number of a 
procurements running to different timetables. In setting the timing of these 
procurements, IPS will take into account a range of factors, one of which will 
be the degree of risk associated with any particular timing decision. In addition, 


44 Reproduced in paragraph 17, appendix 15 of the report, 
http://www.publications.parliament.uk/pa/em200506/cmselect/cmsctech/1032/1032wel7.htm 
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IPS will also consider other factors such as the benefit that will be delivered, 
the alignment with other procurements and the need to meet particular legislative 
requirements and international obligations. Each of the relevant factors will be 
considered and will inform the decision as to the best time to run the 
procurement process. 


The Government can assure the committee that risk management will be central 
to the procurement process itself. IPS will regularly review the risk register as 
a whole, the cost impact of the risks associated with individual contracts, its 
exposure to existing risks, and the balance between risks which IPS ‘owns’ and 
those it transfers to suppliers. External review of risks will be provided by the 
programme’s Independent Assurance Panel. 


The Government can also assure the committee that the procurement will include 
assessment of the potential cost impact of our own risks on the whole life cost 
of the contract. This assessment will be wider than IPS and extend to potential 
impacts on costs incurred by the bidders. 


Finally, the Government wishes to make clear that the statements in paragraph 
113 of the report that “the programme still contains considerable risk at this stage 
of procurement” (Qinetiq) do not contradict the statements that “risk is being 
appropriately considered” (NPL) and “within the ID area [risk analysis] seems 
to have been successful” (British Computer Society). Risk can be properly 
analysed and managed, and an informed decision can be taken to proceed into 
the procurement stage of a project with outstanding risks, provided there are 
proper treatment plans in place appropriate to each risk. 


36. We recommend that the Home Office make details of its risk model 
public and that it takes steps to ensure that advice regarding risk 
management can feed into that model. (Paragraph 117) 


The model for risk management has been developed in line with guidance from 
the Home Office PPMSU (Programme and Project Management Support Unit) 
and is an adaptation of the OGC’s approach* reflecting the level of maturity of 
risk management within the Programme. For example, where the OGC requires 
consideration of a proximity date when considering risk, the programme has 
extended this to include consideration of the dates for both when the impact will 
be felt and the trigger (e.g. the date or event that will trigger those impacts). 
Similar refinements are made as part of the risk management team’s programme 
of continuous improvement. 


Sha We recommend that an overall indication of the outcomes of the 
OGC Gateway Reviews, but no specifics, be made public in order to increase 
confidence in the scheme. (Paragraph 119) 


IPS follows the OGC guidelines with regard to Gateway review reports. The 
OGC report is produced for the project SRO and is not made public. To make 
any part of it public would set a precedent and undermine the usefulness of the 
OGC Gateway report as a candid and unbiased report to the SRO. 


This policy is currently being tested with the Information Tribunal following a 
request under the Freedom of Information Act for one of the Identity Cards 
Programme OGC Gateway reports. This request was originally refused by OGC 
but, following an appeal, the Information Commissioner ruled that the report 
should be disclosed. At the time of writing OGC is appealing against this 
decision. 


“5 As outlined in the “Management of Risk: Guidance for Practitioners”, 
http://www.ogce.gov.uk/guidance_management_of_risk.asp 


38. It is important that the impact of a politically-imposed deadline will 
not override the impact of scientific advice or evidence on the readiness of 
the scheme and we seek reassurance from the Government on this point. 
(Paragraph 120) 


During the development of the Identity Cards Programme there is no evidence 
that Government has thus far imposed politically-motivated deadlines, and no 
timetable is dictated by the legislation. There is however robust evidence of its 
willingness to ensure that all the necessary building blocks — in terms of evidence 
and assurance — are in place before procurement starts. IPS has run two rounds 
of consultation, trials and studies through NPL, market-sounding activities and 
consulted widely in the biometrics community to ensure it is getting the best 
advice and assurance through the Biometrics Experts Group and the Biometrics 
Assurance Group. 


There are some deadlines which have to be taken into account but the risk 
associated with these can be mitigated by our control over the incremental nature 
of any rollout. As the Committee will be aware, some deadlines relating to the 
introduction of biometric technology are set by the European Union. For example 
there will be a deadline for the introduction of biometrics into the Residence 
Permit to be issued to nationals of non-EU countries. 


The timescales for deployment of the scheme must be considered in a context 
wider than the Government’s domestic agenda. It should be noted that we are 
closely involved with all those biometric initiatives which impact the Identity 
Cards scheme and our progress in these is aligned with that of other European 
countries. These include those already operational such as the fingerprinting and 
sharing of data on asylum seekers across Europe, but also compliance with 
regulations on the Biometric Residence Permit, and keeping in step with our EU 
partners on the introduction of fingerprint biometrics into the passport. 


3o: We emphasise the importance of the development of an _ holistic 
approach to risk management in order to ensure that focus on biometrics 
as an emerging technology does not detract attention from other aspects of 
the scheme. (Paragraph 122) 


As indicated elsewhere, the Programme’s risk register includes risks from a range 
of categories (drawn from the Treasury Orange Book). In order to ensure 
consideration of as wide a spread as possible, these categories are used to provide 
a gap analysis which will enable the programme to develop a robust plan for 
managing these risks. 


Our efforts on risks and research have been greater in the field of biometrics 
than in some other areas because this area of technology is less mature than 
others. For the same reason we have been more prescriptive about the biometric 
solution than the ICT solution where the maturity and uniformity of the market 
makes it better able to respond to an output-based set of requirements. 


ICT system 


40. Industry is hoping that the commencement of procurement and the 
release of specifications will clarify the Home Office’s position. Once the 
specifications have been released, we urge the Home Office to take steps to 
ensure that the specifications, requirements and risks have been clearly 
understood by all involved. (Paragraph 126) 


The requirements are being written in an output-based format and have been 
audited by appropriate senior officials within IPS to ensure that the language is 
clear and unambiguous. These requirements will undergo further scrutiny before 
final release. Potential contractors will have the opportunity to ask clarification 
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questions which will be answered to all parties provided they are not proprietary 
in nature. It is also intended to engage face to face with the competitors under 
the supervision of commercial officers to explain any areas that are still not clear. 


41. The Home Office is reliant on external expertise in the area of ICT 
and is unable to act as an intelligent customer of scientific advice. We 
recommend that the Home Office uses a senior and experienced systems 
architect to advise on the specifications and to provide support during the 
procurement process. (Paragraph 129) 


IPS is not wholly reliant on external scientific advice having access to 
established professional technical groups in the Home Office in the areas of 
Biometrics (e.g. the Biometrics Experts Group) and ICT. This is complemented 
by specialist advice from bodies such as QinetiQ (see the response to paragraph 
30 of the report’s conclusions) and the National Physical Laboratory (NPL). Also 
the BAG, chaired by the Government Chief Scientific Advisor Sir David King, 
has been working with the programme for some time. 


We are focused on ensuring that the right level of ICT advice is present within 
the programme to provide assurance on the requirements for the procurement 
process. A Chief Technical Architect will be responsible for maintaining and 
ensuring the compliance with the scheme architecture. 


42. We recommend that the Home Office give the security properties of 
the solution a very high priority, not only from the point of view of being 


trustworthy but also to ensure that the security features do not adversely 


impact upon the operation of the scheme. Furthermore, we suggest that if 
possible, the solution should be based on security architectures, technology 
and processes that are already in use. (Paragraph 135) 


The Government is very conscious of how important it is to ensure that the 
National Identity Scheme is secure and accepted a specific amendment to the 
legislation when it was going through Parliament which emphasises this 
requirement*. 


To that end, we have sought specialist advice in preparing both the security 
principles and requirements behind the scheme as the programme prepares for 
the commencement of a procurement process. 


Security has been given a very high priority since the inception of the project, 
and continues to be addressed as a primary issue in all aspects of the Identity 
Cards Programme. 


There is a dedicated full-time team of security professionals, experienced in 
physical, electronic, procedural, personnel and information systems security, who 
work closely with all projects to ensure that security aspects are addressed 
appropriately and effectively. The in-house team are supplemented by readily 
available advice and _ practical assistance from CESG, (GCHQ’s 
Communications-Electronics Security Group*’, the National Technical Authority 
for Information Assurance), NISCC (National Infrastructure Security Co- 
ordination Centre*’), The Security Service and other government departments. 
This group of experts are highly experienced in dealing with processes and 
systems that require a high level of security. Security threat and risk assessments 
have been undertaken as part of this work and such assessments are updated as 
the National Identity Scheme develops. 


46 This led to the requirement that the record of data should be "secure and reliable" in section 1.3 of the 
Act: http://www.opsi.gov.uk/ACTS/acts2006/60015--a.htm#1 

47 http://www.cesg.gov.uk/ 

48 http://www.niscc.gov.uk/ 


The Identity Cards Programme and the scheme which it will deliver are subject 
to Cabinet Office policies and will be accredited by the pan-Government 
accreditor through the design, procurement, rollout and operational life of the 
scheme. Systems will not be given approval to operate unless they meet all 
security requirements. 


In building the scheme, account will be taken of technology and business 
processes that have already been proven in relevant implementations both in the 
UK and elsewhere. 


Public engagement and communication 


43. We support the identity cards programme’s public communications 
strategy. However, we believe that this effort has been undermined by 
damaging media reports. We recommend that the Home Office seeks to 
inform the identity cards debate with accurate statistics and evidence, and 
communicates with the media more clearly in addition to seeking to rebut 
allegations as they arise. (Paragraph 141) 


The Government welcomes the committee’s support of the programme’s 
communications strategy and their recognition that it has at times been 
undermined by misleading media reports which often generate confusion and 
misunderstanding. For example, in January 2006 there were press articles which 
confused use of the terms “RFID” and “Radio Frequency” and implied that 
Identity Cards would allow people’s movements to be tracked from a distance 
without the knowledge of the owner. This was untrue and a press statement and 
a letter of correction were issued by the Home Office. 


Evidence such as research findings and known facts are cited where possible to 
inform the identity cards debate. For example the identity cards website contains ~ 
facts and figures about identity fraud, fraudulent passports and illegal migrants*?. 


IPS also cite statistics from other programmes where biometric technology is 
already being used successfully, e.g. the FBI’s Integrated Automated Fingerprint 
Identification System, the UK’s NAFIS (National Automated Fingerprint 
Identification Service) and IDENT1 systems, the United Arab Emirates iris 
database and the US-VISIT border control database. 


Government continually tries to improve its communication of accurate statistics 
to the press and other interested stakeholders. The experience we have with crime 
statistics demonstrates that it takes considerable resource over a prolonged 
number of years to improve the accuracy of the reporting of statistics. In the 
case of identity cards we do not have the years of experience we have in crime 
statistics but will continue to apply what we have learnt through the 
communication of these statistics. As noted during the evidence this is a 
continual challenge as we tend to have a weak numeracy culture in this country. 


IPS regularly seeks to rebut incorrect allegations and misinformation by sending 
letters to the relevant newspaper, issuing a statement by a Home Office ministers 
or requesting corrections to information and articles on third party websites. 
However, even if results are published, which is not always the case, they 
invariably are given less prominence than the original article. IPS have provided 
articles for publications such as Electronic Government magazine, London 
Chamber of Commerce and Industry magazine, Government IT magazine and 
Parliamentary Monitor. 


4° http://www.identitycards. gov.uk/benefits-facts.asp 
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During the passage of the Identity Cards legislation, the Home Office press 
office organised a series of briefings for relevant journalists with ministers and 
officials from the programme. These included an on-the-record round-table 
discussion with the Director of the Identity Cards Programme, the Head of the 
e-Government Unit and the Director of Information Security for Royal Mail. The 
briefing was attended by a small group of specialist journalists from national 
newspapers and IT press and covered a range of issues including the reliability 
of biometrics and the Government’s ability to deliver the scheme. A number of 
interviews with key officials including IPS’s Executive Director of Service 
Delivery have also been facilitated and the Press Office continues to provide 
regular verbal briefings for relevant journalists to coincide with announcements 
relating to the scheme. IPS expects to arrange further briefings in the future as 
its plans develop. 
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